Web server and/or operating system information must be protected.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-6724	WG520 A22	SV-36672r1_rule	ECSC-1	Low

Description
The web server response header of an HTTP response can contain several fields of information including the requested HTML page. The information included in this response can be web server type and version, operating system and version, and ports associated with the web server. This provides the malicious user valuable information without the use of extensive tools.

STIG	Date
APACHE SERVER 2.2 for Unix	2015-06-01

Details

Check Text ( C-29517r1_chk )
Enter the following command: grep "ServerTokens" /usr/local/apache2/conf/httpd.conf The directive ServerTokens must be set to “Prod” (ex. ServerTokens Prod). This directive controls whether Server response header field that is sent back to clients that includes a description of the OS-type of the server as well as information about compiled-in modules. If the web server or operating system information are sent to the client via the server response header or the directive does not exist, this is a finding. Note: The default value is set to Full.

Check Text ( C-29517r1_chk )

Enter the following command:

grep "ServerTokens" /usr/local/apache2/conf/httpd.conf

The directive ServerTokens must be set to “Prod” (ex. ServerTokens Prod). This directive controls whether Server response header field that is sent back to clients that includes a description of the OS-type of the server as well as information about compiled-in modules.

If the web server or operating system information are sent to the client via the server response header or the directive does not exist, this is a finding.

Note: The default value is set to Full.

Fix Text (F-26581r1_fix)
Edit the /usr/local/apache2/conf/httpd.conf file and ensure the directive is set to Prod.